Encrypted, but wrong: Group chats vulnerable to manipulated content | heise online

heise+ entdecken

SuchenAbo

Suchen

Alle Magazine im Browser lesen<br>AnzeigeSpecial: Collaboration im KI-Zeitalter

Newsletter<br>heise-Bot<br>Push-Nachrichten

${lead}

${lead}

${content}

${content}

${content}

${content}

Anzeige<br>Special: Collaboration im KI-Zeitalter

Advertisement

Advertisement

Group chats on major messaging services like Whatsapp, iMessage, Signal, and Threema are well end-to-end encrypted, meaning unauthorized parties cannot read them. However, they are not protected against manipulation of displayed content in group chats if the perpetrator is a legitimate group member or controls a member's device. Such attackers can send chat messages that carry the same identification number but have different content for different recipients. This breaks so-called transcript consistency: Chat participants suddenly have different versions of the chat and are unaware of it.

Continue after ad

The false messages can even remain in quotes from other chat participants, giving a chat participant a completely wrong idea of the chat history. Example: The chat group unanimously agrees to a proposal, but one chat participant sees agreement to a completely different proposal. Or: A malicious group member sends a hyperlink to the group that leads to a funny cat picture. The perpetrator sends a link that triggers a malware download to only one group member. The group responds to the funny link with laughter and thanks, which tempts the target person to click on the link.

Or: The invitation to an important meeting is sent to some participants for Monday, and to others, whom the attacker would rather not have present, for a different day, after all resolutions have already been made. Or: Chat moderators are always shown more legitimate content, while certain members are presented with illegitimate content. And so on and so forth.

If a participant uses multiple end devices for the group chat under the same user account, different content can be delivered to them on different end devices (except for Threema, which exhibits the drawback of lacking Forward Secrecy in this regard). Message suppression depending on the end device is also possible with the other three services. All of this works without breaking encryption, not only for text messages but also for multimedia content. Furthermore, polls can be manipulated in various ways.

How Group Chat Works

This was discovered by an Austrian group of IT security researchers led by Gabriel Gegenhuber and reported to the four communication services in early February. Although group chats are now used for (war) critical political decisions at the highest level, none of the four operators are planning immediate measures to eradicate the fundamental problem.

End-to-end encrypted group chats can be implemented in different ways. Threema, iMessage, and formerly Signal, rely on pairwise communication: When a participant sends a message to the group, their client actually sends a copy of the message to every other participant in the background. The larger the group, the more efficient the method currently used by Signal and Whatsapp, where only one message goes from the client to the server, which then forwards it to the other chat participants (“server fan-out‟). Only for the initial transmission of the necessary encryption keys does the sender communicate directly with the other communication partners.

For the malicious messages, the researchers used official (Signal and Threema) or unofficial (Whatsapp, iMessage) clients and modified them through software patches. On the recipient side, the usual software of the messaging services for Android, iOS, Linux, macOS, Windows, and web browsers was used.

Continue after ad

Pairwise Communication

With pairwise communication in group chats, as used by Threema and iMessage, the trick is straightforward: The sender simply sends different content to different recipients using the same message ID. Signal supports both pairwise communication and server fan-out, likely for reasons of backward compatibility.

Furthermore, Whatsapp and Signal can be made to automatically fall back to pairwise communication despite the default server fan-out. This happens when a recipient cannot decrypt a message. They then request a retransmission via pairwise communication, as not all group participants need to receive the message again just because one fails to decrypt it.

Videos by heise

mehr Videos

c't 3003

heise & ct

Peertube

And this failure can be intentionally triggered: As mentioned, Whatsapp and Signal use pairwise communication for the initial transmission of encryption keys. This is where the attacker intervenes: They intentionally send the target client a key that it cannot use to decrypt the sender's “normal‟ chat messages. Then, every normal message triggers an error with a request for retransmission. The malicious sender then sends the faked...